Security
Four guarantees, one retrievable page
The public contract is intentionally read-only and bounded.
- Read-only
- The public contract exposes no write, purchase, or form action.
- Same-origin
- WebMCP resolves to the same-origin MCP endpoint and sends no cookies or API key.
- Rate-limited
- Rate and burst limits apply before any optional authentication.
- Bounded
- Request bodies, JSON depth, result counts, and export sizes are capped.